CISA Warns of React Native Community Command Injection Vulnerability Exploited in Attacks

Cybersecuritynews •Guru Baran • February 6, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-11953 to its Known Exploited Vulnerabilities (KEV) catalog, flagging an OS command injection flaw in the React Native Community CLI as actively exploited in the wild. Added on February 5, 2026, with a federal patching deadline of February 26, 2026, the vulnerability poses severe risks […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Alerts on React Native Command Injection Vulnerability Exploited in Attacks The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-11953 to its Known Exploited Vulnerabilities catalog, identifying an OS command injection flaw in the React Native Community CLI that is actively being exploited. The vulnerability was added on February 5, 2026, with a federal patching deadline set for February 26, 2026. 2 sources 32

Extracted Entities

CISA Warns of React Native Community Command Injection Vulnerability Exploited in Attacks

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)